Wagtail
Torchbox · 23 CVEs
Wagtail: Reflected XSS in dynamic image URL generator view
Jul 1, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
Jul 1, 2026
Wagtail: Improper permission handling in image preview
Jul 1, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
Jul 1, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
Jul 1, 2026
Wagtail: Improper restriction handling on Documents and Images API
May 11, 2026
Wagtail: Improper permission handling when copying pages
May 11, 2026
Wagtail: Improper permission handling when deleting form submissions
May 11, 2026
Wagtail: Improper permission handling when viewing page history
May 11, 2026
Wagtail: Improper permission handling when comparing revisions
May 11, 2026
Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes
Mar 5, 2026
Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface
Mar 5, 2026
Wagtail has improper permission handling on admin preview endpoints
Feb 4, 2026
Wagtail regular expression denial-of-service via search query parsing
Jul 11, 2024
Disclosure of user names via admin bulk action views in wagtail
Oct 19, 2023
Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
Apr 3, 2023
Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
Apr 3, 2023
Comment reply notifications sent to incorrect users in wagtail
Jan 18, 2022
Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks
Jun 17, 2021
Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
Apr 19, 2021
Cross-Site Scripting in Wagtail
Jul 20, 2020
Potential Observable Timing Discrepancy in Wagtail
Apr 30, 2020
Possible XSS attack in Wagtail
Apr 14, 2020
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-54263 | Wagtail: Reflected XSS in dynamic image URL generator view | HIGH | 0.36% | Jul 1, 2026 |
| CVE-2026-54262 | Wagtail: Pages translations can be created without page permissions when using simple_translation | MEDIUM | 0.27% | Jul 1, 2026 |
| CVE-2026-54261 | Wagtail: Improper permission handling in image preview | MEDIUM | 0.34% | Jul 1, 2026 |
| CVE-2026-54259 | Wagtail: Improper restriction handling on Documents and Images chosen endpoints | MEDIUM | 0.27% | Jul 1, 2026 |
| CVE-2026-54260 | Wagtail: Denial of service via unbounded filter specs in the image preview | MEDIUM | 0.37% | Jul 1, 2026 |
| CVE-2026-44201 | Wagtail: Improper restriction handling on Documents and Images API | MEDIUM | 0.31% | May 11, 2026 |
| CVE-2026-44200 | Wagtail: Improper permission handling when copying pages | MEDIUM | 0.34% | May 11, 2026 |
| CVE-2026-44199 | Wagtail: Improper permission handling when deleting form submissions | MEDIUM | 0.30% | May 11, 2026 |
| CVE-2026-44198 | Wagtail: Improper permission handling when viewing page history | MEDIUM | 0.27% | May 11, 2026 |
| CVE-2026-44197 | Wagtail: Improper permission handling when comparing revisions | MEDIUM | 0.35% | May 11, 2026 |
| CVE-2026-28222 | Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes | MEDIUM | 0.61% | Mar 5, 2026 |
| CVE-2026-28223 | Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface | MEDIUM | 0.61% | Mar 5, 2026 |
| CVE-2026-25517 | Wagtail has improper permission handling on admin preview endpoints | MEDIUM | 0.49% | Feb 4, 2026 |
| CVE-2024-39317 | Wagtail regular expression denial-of-service via search query parsing | HIGH | 0.61% | Jul 11, 2024 |
| CVE-2023-45809 | Disclosure of user names via admin bulk action views in wagtail | LOW | 0.45% | Oct 19, 2023 |
| CVE-2023-28837 | Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files | MEDIUM | 1.07% | Apr 3, 2023 |
| CVE-2023-28836 | Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views | HIGH | 0.78% | Apr 3, 2023 |
| CVE-2022-21683 | Comment reply notifications sent to incorrect users in wagtail | MEDIUM | 0.97% | Jan 18, 2022 |
| CVE-2021-32681 | Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks | MEDIUM | 1.11% | Jun 17, 2021 |
| CVE-2021-29434 | Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields | HIGH | 0.63% | Apr 19, 2021 |
| CVE-2020-15118 | Cross-Site Scripting in Wagtail | HIGH | 1.10% | Jul 20, 2020 |
| CVE-2020-11037 | Potential Observable Timing Discrepancy in Wagtail | MEDIUM | 0.25% | Apr 30, 2020 |
| CVE-2020-11001 | Possible XSS attack in Wagtail | MEDIUM | 1.27% | Apr 14, 2020 |
Showing 1 to 23 of 23 CVEs